The OSI Model Explained Layer by Layer
What is the OSI model?
The OSI (Open Systems Interconnection) model is a seven-layer reference framework that describes how data moves from an application on one device to an application on another. Each layer has a specific job, from physical signals at Layer 1 to user-facing services at Layer 7. Engineers use it to explain protocols, place devices and troubleshoot problems in a logical order.
Why the OSI model still matters
Real networks run the TCP/IP suite, not a pure OSI stack, so the OSI model is a teaching and troubleshooting tool rather than a protocol. Its value is a shared vocabulary. When a colleague says "that is a Layer 2 problem", everyone knows to look at switching, VLANs and MAC addresses rather than DNS or the application.
Vendors also describe products by layer. A "Layer 3 switch" can route between VLANs, and a "Layer 7 firewall" can inspect application traffic such as HTTP requests. Interview questions for network and security roles regularly start here, so it pays to know each layer well.
The seven layers at a glance
| Layer | Name | Main job | Example protocols | Devices and data unit |
|---|---|---|---|---|
| 7 | Application | Network services that applications use | HTTP, HTTPS, DNS, SMTP, SSH, FTP | Proxies, Layer 7 firewalls; data |
| 6 | Presentation | Data formatting, encoding, encryption and compression | TLS (often placed here), JPEG, ASCII, UTF-8 | Handled in software; data |
| 5 | Session | Opens, manages and closes sessions between applications | NetBIOS, RPC, session handling in TLS | Handled in software; data |
| 4 | Transport | End-to-end delivery, ports, reliability and flow control | TCP, UDP, QUIC | Stateful firewalls, load balancers; segment or datagram |
| 3 | Network | Logical addressing and routing between networks | IPv4, IPv6, ICMP, OSPF | Routers, Layer 3 switches; packet |
| 2 | Data link | Framing, MAC addressing and access to the local medium | Ethernet, Wi-Fi (802.11), ARP, 802.1Q VLAN tagging | Switches, bridges, access points; frame |
| 1 | Physical | Bits as electrical, light or radio signals | Ethernet cabling standards, fibre, radio | Cables, hubs, repeaters, transceivers; bits |
Some protocols sit awkwardly. ARP links Layer 3 addresses to Layer 2 addresses, and TLS is variously placed at Layers 4 to 6. Do not worry about edge cases; focus on what each layer is responsible for.
Encapsulation: how data moves down and up the stack
When you send a web request, each layer wraps the data from the layer above with its own header. This process is called encapsulation. The receiver reverses it, stripping one header per layer, which is de-encapsulation.
- The browser creates an HTTP request (Layers 7 to 5).
- TCP adds a header with source and destination ports, such as a random high port and 443, forming a segment (Layer 4).
- IP adds source and destination IP addresses, forming a packet (Layer 3).
- Ethernet adds source and destination MAC addresses and a trailer with an error check, forming a frame (Layer 2).
- The NIC turns the frame into signals on the cable or radio (Layer 1).
Routers rewrite the Layer 2 header at every hop but leave the IP addresses alone (unless NAT is involved). Switches read only the Layer 2 header. Open a capture in Wireshark and you can expand each of these headers in turn, which makes the model concrete.
OSI compared with the TCP/IP model
| TCP/IP layer | Matching OSI layers | Example |
|---|---|---|
| Application | Application, Presentation, Session | HTTP, DNS, SSH |
| Transport | Transport | TCP, UDP |
| Internet | Network | IP, ICMP |
| Link (network access) | Data link, Physical | Ethernet, Wi-Fi |
The TCP/IP model is what operating systems actually implement. Our guide to TCP/IP covers ports, the three-way handshake and how TCP differs from UDP.
Troubleshooting with the OSI model
A bottom-up approach stops you guessing. Suppose a user says "the intranet is down". Work through the layers and confirm each one before moving up.
- Layer 1: is the cable connected and the link light on? Is Wi-Fi associated?
- Layer 2: is the switch port in the right VLAN? Does
ip neighshow the gateway MAC address? - Layer 3: does the host have the right IP, mask and gateway? Does
pingreach the gateway and the server? - Layer 4: is the service listening and is a firewall allowing the port?
ss -tulpnon the server shows listening sockets. - Layer 7: does DNS resolve the name with
dig, and does the application return an error?
A worked example
A finance team laptop cannot open the payroll portal, yet colleagues on the same floor can. The link light is on, so Layer 1 looks fine. ip a shows an address in 192.168.30.0/24 while everyone else is in 192.168.20.0/24. The switch port was moved to the guest VLAN during a desk change, a Layer 2 fault that only looked like an application problem. Reassigning the port to the correct VLAN fixes it, and nothing above Layer 2 needed to change.
Experienced engineers sometimes start in the middle with a ping test, because a successful ping proves Layers 1 to 3 work in one step. Either way, the model gives structure to what you check. Practising this routine until it is automatic is a core part of SkillNewton's online networking course.
Mapping security controls to layers
Security teams use the same layers to plan defences. Port security and 802.1X protect Layer 2, access control lists filter at Layers 3 and 4, and web application firewalls inspect Layer 7. Spreading controls across layers is part of defence in depth, explained in our network security guide.
Common mistakes
- Treating the OSI model as a protocol that networks actually run, rather than a reference framework.
- Mixing up data units, for example calling a Layer 2 frame a packet.
- Placing switches at Layer 3 by default, when a standard access switch works at Layer 2.
- Jumping straight to application settings before checking cabling, VLANs and IP configuration.
- Memorising the layer list without being able to name a protocol and a device for each.
Frequently asked questions
Which layer does a firewall work at?
It depends on the firewall. A basic packet filter works at Layers 3 and 4, while next-generation firewalls also inspect application traffic at Layer 7.
Is Wi-Fi Layer 1 or Layer 2?
Both. The 802.11 standards define the radio signalling at Layer 1 and the framing and MAC addressing at Layer 2.
Do I need to memorise the Session and Presentation layers in depth?
Know their purpose, but most practical work focuses on Layers 1 to 4 and Layer 7, where you will configure and troubleshoot most often.
Where does the OSI model fit in a beginner's study plan?
Learn it right after core networking concepts and before routing, switching and security topics.